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This summary report is one of a series that 
addresses major policy, management, and program 
issues facing the new administration. The issues 
discussed here represent the results of gao work in 
the area of information management and 
technology. 

Effective gov^emment depends directly on effective 
automation to support programs and initiatives. 
Viituaily all facets of government rely on technol- 
ogy, but management of this technology has been 
uneven. Critical areas have not been given focused 
attention, and major computer and telecommunica- 
tions systems have met with mixed success. 

The possibility for significant improvement is at 
hand. This report describes the environment in 
which information technology has been managed 
and identifies four areas that need attention: (1) 
strategic planning that ties agencies' technology to 
their missions, (2) systems development projects 
that provide technical capability, (3) security that 
protects sensitive information, and (4) personnel 
who oversee complex automated systems. These 
areas, all of which are undergoing rapid changes, 
provide vital support to government operations. 
The new administration and the Congress have an 
opportunity to make lasting improvements to gov- 
ernment services by improving management of the 
technology that supports these services. 
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The Information Technology Environment 
in the Federal Govemnrient 



The environment in which the federal gov- 
ernment manages its information technol- 
ogy is one of tensions between time, 
technology, cost, and talent. It is charac- 
terized by long-term projects, short-term 
tenures of senior and mid-level managers 
who often refocus program priorities, and 
rapid changes in technology. In addition, 
federal systems are often unique and 
extremely complex, and are acquired in an 
environment that is unlike private indus- 
try. F'inally, the government's information 
technology costs are high and rapidly 
increasing: it is projected that about $17 
billion will be spent on information tech- 
nology in fiscal year 1989, as compared to 
$9 billion spent in 1982. 

Today, information technology is essential 
to carrying out our nation's most vital 
functions. Our ability to avert war and to 
defend ourselves depends significantly on 
the strength of our computer and commu- 
nications systems. Our ability to deliver 
social security checks to our elderly, to 
deliver benefits to our disabled veterans, 
to direct aid to needy families, all depends 
on the smooth operation of computer and 
telecommunications systems. Our nation 
cannot land planes safely or launch a sin- 
gle space vehicle without the accurate and 
reliable functioning of immensely complex 
computer technology. Our ability to raise 
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The Information Techno)og>* 
Environment in the 
Federal Government 



the revenue that pays for these services is 
tied to automated systems that process tax 
information. 

The role of the federal government in man- 
aging this technology is equally important: 
strong, informed leadership is essential to 
well-functioning systems. This leadership 
must understand the environment in 
which technology operates, and the partic- 
ular demands that accompany federal 
automation projects. 

Many federal projects take a long time to 
implement, overlapping the administra- 
tions that manage them. A multi-billion- 
dollar modernization program supporting 
social security began in 1982. Although 
originally estimated to be completed in 5 
years, completion is still years away. From 
1982 until now, it has been developed 
under three commissioners or acting com- 
missioners, some of whom have changed 
the system's goals and objectives. A tax 
system redesign, which originally began in 
1968, never progressed beyond the concep- 
tual design stage and was eventually killed 
in 1978. It was started anew in 1982 and 
will cost several billion dollars between 
now and 1998 when completed; this 
renewed effort has also undergone a 
number of redirections by a succession of 
top managers. 
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Tho Information TechnoIog>' 
KiiviroiinuMit in the 
PV<!*»ral Government 



Dramatic changes take place in informa- 
tion technology between the time many of 
the government's systems development 
projects start and when they end. Small 
computers using advanced chip technol- 
ogy, powerful communications technology, 
and large-scale, cheap mass storage are 
but a few recent changes. Such advances 
offer possibilities to revolutionize the way 
the government and industry do business. 
By the year 2000, a little more than a dec- 
ade from now, the possibilities are 
expected to grow even more. Rapid 
advances coupled with long-term projects 
place federal managers in a difficult and 
challenging position as they make choices 
about technology. 

Many federal systems are being designed 
as one-of-a-kind in their size and complex- 
ity. Systems supporting aviation, veterans' 
programs, tax administration, social secur- 
ity, space programs, and defense have lim- 
ited private-industry models and rival or 
exceed the cost, size, and complexity of the 
largest systems of any private firm. 

The government's systems are operated in 
an oversight arena unparalleled in private 
industry. The federal government's com- 
mitment to competition has been embodied 
and reaffirmed in legislation such as the 
Brooks Act, the Paperwork Reduction Act 
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of 1980, and the Competition in Con- 
tracting Act. Its commitments to protect 
the privacy of citizens and the security of 
sensitive computerized information are set 
forth in the Privacy Act of 1974 and the 
Computer Security Act of 1987. The regu- 
latory and budgetary environment is 
designed to provide a set of checks and 
balances to achieve the objectives of these 
acts and make sure that systems are effec- 
tive and that their value is worth their 
cost. 

The cost of the federal government's com- 
puter systems is staggering. For example, 
a system proposal for satellite control 
operations that is under study could cost 
$48 billion to implement between 1990 and 
2015. Another project, the government's 
new telephone system known as FTS 2000, 
could cost up to $25 billion over the next 
10 years. 

The technological challenges facing this 
nation over the next few years call for 
strong leadership. The incoming adminis- 
tration, the Congress, and managers 
throughout the government must act 
together to ensure that our information 
technology works, and works well. With- 
out this leadership, we cannot rely on our 
national defenses, no matter how dedi- 
cated our people or how sophisticated our 
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equipment. Without it, we cannot hope to 
manage our finances, provide our social 
services, or guarantee the safety of our 
transportation systems. 

Our nation's leadership must address sev- 
eral key issues over the next few years if 
wc are to take full advantage of our tech- 
nology. We must effectively harness this 
technology to accomplish our govern- 
ment's missions. We must make sure that 
our systems work as planned. We must 
adequately protect the information in 
these systems. Finally, we must get and 
keep the talented people needed to oversee 
the systems. In short, to govern our nation 
effectively, we must manage our technol- 
ogy effectively. 
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Strategic Plarming 



Strategic planning lor computers and tele- 
communications is critical to focusing an 
agency's use of information resources 
toward achieving the mission of the organ- 
ization. However, in too many instances, 
agencies either do not complete strategic 
plans or develop plans that are not effec- 
tive. Moreover, strategic plans are fre- 
quently not tied to agency budget requests. 
As a result, millions are spent on computer 
systems that do not meet agency needs, do 
not perform as desired, are not cost-effec- 
tive, and are not compatible with existing 
and future agency systems. 

Strategic plans identify an agency's mis- 
sion, relate each automation program 
objective to this mission, state the objec- 
tives in measurable terms, and set priori- 
ties for automation efforts. Strategic plans 
are also important in ensuring that sys- 
tems will be integrated resources that can 
easily communicate with each other. Inte- 
gration can be achieved by establishing 
and enforcing standards that ensure dif- 
ferent systems can exchange information 
and share complex, expensive software. 

Federal agencies frequently do not use 
strategic planning effectively. The nation's 
warning and attack assessment system's 
unit for monitoring communications lines 
has design deficiencies that will preclude 
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Strat<*Kic IMauninK 



Its installation and use unless substantial 
changes are made. Besides these deficien- 
cies, the unit is not compatible with other 
equipment at the operating facility. 

In another case, major decisions shaping 
the government's planned procurement of 
k)ng-distance services known as PTS 2000 
have been made without adequate analy- 
sis. Because the agency did not conduct a 
comprehensive analysis of a range of alter- 
natives, it was uncertain whether FTS 
2000 is optimal technically, economically, 
or contractually. 

In another instance, because plans for 
modernizing a worldwide military com- 
mand and control system were not 
updated, the agency was preparing to 
unnecessarily spend $500 million for new 
computer systems. These new systems 
were to meet requirements that had been 
in most cases satisfied by previous 
expenditures. 

Agencies do not perform effective strate- 
gic planning because top managers do not 
recognize its importance in directing major 
automation efforts. Many continue to view 
it as a bureaucratic exercise to comply 
with government regulations, rather than 
a necessary effort to support mission 
objectives. 

I i 
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The govcM-nment needs to ireat strategic- 
planning seriously. Top-level commitment 
to strategic information resources planning 
is imperative. Specifically, agency top 
managemcMit needs to: 

• Recognize the role and importance of stra- 
tegic planning in guiding information 
resource activities. 

• Develop implement, and enforce strategic 
plans that effectively marshal information 
technology toward achieving the agency's 
mission. 

• Review and update plans periodically to 
ensure th(Mr applicability and usefulness, 

• Knsure that individual system projects are 
developed in accord with strategic plans, 

• Knsure that strategic plans are c(Misisteni 
with budget requests and agency repro- 
gramming actions. 
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Some of the government's major systems 
development projects have had costs esca- 
late by hundreds of millions of dollars and 
schedules slip by years. In many cases the 
new systems do not work as planned or 
meet user needs, and waste millions of dol- 
lars. These conditions jeopardize the gov- 
ernment's ability to carry out some of its 
most fundamental missions. The following 
are some recent examples: 

• A federal aviation system may not have 
been the most cost-beneficial approach 
because alternative system architectures 
were not evaluated. We estimated that a 
different system could reduce costs by 
more than $750 million. 



• Evolving and expanding requirements for 
a defense automated financial system have 
caused estimated costs to grow from about 
$30 million to almost $500 million and 
schedules to slip by more than 5 years. 

• Critical systems planning steps for a $1.5 
billion defense logistics modernization pro- 
ject were not completed, making it ques- 
tionable whether the system will be worth 
its cost, and whether it will correct 
existing deficiencies. 

• A nnilti-million-dollar expansion of a sys- 
tem supporting veterans programs was 
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Systems 

Development Pn>jects 



implemented without adequate analysis of 
costs and benefits. It remained questiona- 
ble whether the most cost-effective system 
was selected. 

These problems result from errors made in 
the early stages of a system's develop- 
ment. Agencies frequently do not ade- 
quately define their requirements, and 
therefore implement systems that do not 
meet users' needs. Agencies frequently do 
not consider less costly alternatives to the 
systems they select. Selected systems often 
are not justified, with the result that their 
costs greatly exceed benefits. Once pro- 
gram implementation is underway, prob- 
lems often persist because of failure to 
follow approved plans, inadequate testing, 
inadequate supervision, and lack of man- 
agement support. 

Problems that arise during the develop- 
ment and implementation of a system can 
be costly and difficult to resolve. To pre- 
vent these problems, top management 
needs to establish good management prac- 
tices to control projects through each of 
the system's phases: initiation, develop- 
ment, and operation. Specifically, agencies 
need to: 

• Ensure that, for each systems development 
project, requirements are adequately 
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defined, alternative solutions are fully 
evaluated, and the costs and benefits of 
alternatives are assessed. 

Obtain extensive user involvement, assign 
and retain competent staff, promote con- 
tinuing communication among managers, 
standardize approval processes for plans 
and decisions, provide for complete and 
accurate documentation, and establish and 
use appropriate management controls to 
make decisions on system costs and 
schedules. 
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Automated Inf omiation System Security 



Estimates of the annual cost of security 
breaches suffered by public and private 
institutions range into the billions of dol- 
lars. The rapid growth of automated infor- 
mation systems has increased the 
government's exposure to these risks. 
Recent instances of security breaches in 
automated information systems have 
resulted in the loss of assets, compromise 
of program objectives, and leaks of sensi- 
tive information. 

iMany current automated information sys- 
tems are vulnerable to a range of problems 
because agencies do not incorporate appro- 
priate security controls during develop- 
ment, and in day-to-day operations. In our 
1985 review of 25 systems at 17 civilian 
agencies, we testified that each of these 
systems is vulnerable to abuse, destruc- 
tion, error, fraud, and waste because of 
very limited use of security controls, such 
as risk management and audit trails. 

A 19' jOfficeof Technology Assessment 
review of 142 agency components found 
similar weaknesses in information security 
controls and management practices. In 
1988 we reported that, in 9 systems devel- 
opment projects we reviewed, management 
made significant project decisions without 
adequate consideration of potentially 
important security factors. 
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Automated Infomtatioit 
System Security 



When agencies do not incorporate appro- 
priate controls and do not adequately con- 
sider security in system development and 
operations, the results can be disastrous. A 
clerk used a transportation computer 
processing system to embezzle more than 
$800,000. Employees prepared fraudulent 
documents for a tax processing system, 
directing refunds to themselves and 
others. At least 30 employees obtained 
illicit access to computer and data files 
supporting agricultural programs, and 
made unauthorized and premature disclo- 
sure of highly sensitive information. Some 
federal agencies have also been the victims 
of computer viruses — deliberate tamper- 
ing with software — that have destroyed 
the integrity of their software and data. 

In addition to these malicious acts, agen- 
cies remain vulnerable to acts of negli- 
gence. In one review, we reported that 
flaws in a social security control s: "em 
caused millions of dollars in errone^^.o 
payments. We further reported that a pro- 
gram had provisions for field office per- 
sonnel to override many of the computer 
system's controls, and as a result incorrect 
and incomplete data were entered and 
processed. 

As recognized in the recently enacted Com- 
puter Security Act of 1987, the cver- 
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increasing use of automated systems has 
increased exposure to security breaches. In 
particular, the proliferation of telecommu- 
nications and personal computers has sig- 
nificantly increased the risk of 
unauthorized access to data. 

The rapid pace of technology adds to these 
problems, making it difficult for security 
practices to keep up with changes. In addi- 
tion, inattention to safeguards in the early 
stages of system design is common, with 
the result that systems must be retrofitted 
with security features. Retrofitting tends 
to be more costly and less effective than 
including safeguards during development. 

High-level attention is needed to ensure an 
appropriate level of security for auto- 
mated systems. Agency management must: 

• Evaluate their current agency policies and 
procedures to assure that systems are 
developed and implemented with ap o- 
priate security controls built into the 
design. 

• Improve mechanisms to detect security 
breaches, assess their significance, and 
report them to top-level officials. 
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Technical Personnel 



Qualified technical personnel are needed at 
all levels if the government is to build and 
operate the automated information sys- 
tems that provide essential services to the 
nation. At present, a governmentwide 
shortage of technical staff has resulted in 
many federal agencies not being able to 
meet crucial objectives. Some recent, 
highly publicized problems underscore 
these weaknesses, and the need for 
change. 

The recent stock market crash revealed 
the inability of federal regulators to moni- 
tor the performance of computer systems 
of the various exchanges. Modernization of 
the social security system has been 
delayed by a shortage of management and 
support staff with the technical knowledge 
to implement and complete the project. A 
similar lack of technical expertise at the 
senior-management level has contributed 
to delays in the tax administration system. 

Although this demonstrated lack of techni- 
cal expertise has complex causes, there are 
underlying reasons for it: managers are 
having problems finding competent per- 
sonnel, managers often lack necessary 
technical expertise themselves, and agen- 
cies are having problems keeping their 
most talented staff. 
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In a 1987 survey, about 40 percent of fed- 
eral managers reported to us that their 
ability to hire needed staff had worsened 
over the past 5 years. Competition is par- 
ticularly acute in expanding fields, such as 
computer science. The shortage of trained 
personnel is already apparent and is pro- 
jected to become severe by the year 2000. 
Compounding these problems is the fact 
that the government is in the middle of a 
transition into services supported by high 
technology and needs to acquire technical 
expertise quickly. 



The government is at a disadvantage when 
recruiting because government salaries fall 
far behind those in private industry. A 
Merit Systems Protection Board's recent 
survey found the government's entry-level 
salaries for computer specialists ranged 
from 22.7 to 31.6 percent less than those in 
private industry. The President's Commis- 
sion on Compensation of Career Federal 
Executives found that private industry 
pays senior executives as much as 65 per- 
cent more than the government. The gov- 
ernment is also at a disadvantage because 
questions are being raised about the way it 
defines the roles to be played by its techni- 
cal personnel. 



Unflattering perceptions of government 
employment further complicate efforts to 
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recruit and keep a technical work force. 
Our 1987 survey showed that the greatest 
source of dissatisfaction among senior 
executives is the negative rhetoric directed 
toward pubHc service. 

Low" pay and a bfid image lead to high 
turnover of talented personnel. Private 
corporations court the best government 
employees with offers of high salaries and 
attractive working conditions. The Council 
of Federal Data Center Directors found in 
a recent survey that the employees who 
are most likely to leave an organization are 
those with the most valuable skills. Studies 
show that highly competent employees 
choose workplaces that offer good career 
paths, state-of-the-art systems, training, 
and the chance to use their abilities to the 
fullest. 

If federal agencies are to be effectively 
served in the future by information tech- 
nology, the government must build a first- 
class work force. Responsibility for ensur- 
ing that this work force is in place falls 
directly on the government s top-level 
management, who must: 

• Develop, as a high priority, a strategy to 
hire and train senior-level, technically ori- 
ented managers, and develop career paths 
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tha^ will provide technically trained exec- 
utives who can successfully introduce 
state-of-the-art technology throughout an 
organization. 

• Develop strategies for recruiting and keep- 
ing techxiically skilled, junior-level staff. 

• Establish special salaiy scales for techni- 
cal personnel. 

Top managers should also consider innova- 
tive approaches to focus expert technical 
talent on the critical issues discussed in 
this renort. These approaches could 
include using advisoiy panels of senior 
industry executives experienced at intro- 
ducing ( )mplex technology into 
organizations. 
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